Gnosis Pay Breach Exposed Card Numbers, Addresses and Wallet Details

Gnosis Pay disclosed on Nov. 6 that its monitoring systems detected unauthorized access to the system powering its Gnosis Pay-branded consumer cards three days earlier, on Nov. 3, exposing certain customer information. In its blog post, the crypto debit card provider said containment began within two hours of detection, and that it replaced the affected security credentials and addressed the vulnerability.

The breach was limited to the legacy system behind the company's own branded cards, a business line already scheduled for retirement on Dec. 20, 2026. Gnosis Pay said its enterprise platform, which powers white-label card programs for other businesses, was not affected, and that customer funds were not affected either. "While funds were not affected, we recognise that the security of personal information is just as important," the company wrote.

Breach notifications reviewed by Cointelegraph listed the exposed fields: full payment card numbers, expiration dates, CVV codes, customer names, home addresses and wallet addresses linked to affected accounts. The notifications also cited email addresses, phone numbers, nationalities and, in some cases, banking details such as IBAN and BIC information. One notification confirmed the customer's card was canceled on Nov. 3, with no suspicious transactions or movement of funds detected. Gnosis Pay did not disclose how many customers were affected.

Gnosis Pay emailed every affected customer on Nov. 6 with the specific information taken from their account, reported the breach to its partners, and said it is communicating with the applicable data protection authorities and its card issuer. The company made 3D Secure verification mandatory for all online card payments and increased monitoring of card activity and wallets; those measures stay in place until the consumer system is retired. It is also arranging specialist monitoring for any sign that the exposed information is misused.

Decrypt quoted the company's post on X: "While funds were not affected, the security of personal information is just as important and we take full responsibility." The company warned customers to treat any unexpected email, text, call or letter about Gnosis Pay, a partner app or their card as suspicious, even when it contains real details or refers to a real purchase, and not to click its links. Gnosis Pay said it will never ask customers for a seed phrase, private keys, PIN or full card number, and will never ask anyone to move funds by email, text or phone.

The company also told customers to be careful who they share their address or details of their crypto holdings with, online and offline. Decrypt noted that the warning comes as physical attacks on crypto holders remain a live threat, citing Chainalysis data that more than $30 million was stolen in such incidents in the first half of 2026.

Gnosis Pay is a UK-registered company, Gnosis Pay Co Ltd, and its debit card is issued by Monavate Limited under licence from Visa Europe. Decrypt placed the disclosure in a run of recent security incidents across the industry, alongside the $6.4 billion Binance hack, a Coinbase breach at analytics vendor Amplitude that exposed some customer contact data, and Ledger's warning about devices bought from a suspected compromised reseller. The company said it is carrying out a full review and applying what it learns across its systems.

Cointelegraph reported that Gnosis Pay did not immediately respond to a request for comment, and cited data from OpenRate, a third-party tracker of crypto card activity, showing around 2,400 daily active cardholders and $263,200 in transactions over the previous 24 hours. The disclosure lands weeks before the branded card service shuts down: Gnosis Pay's own notice sets the retirement of the consumer system for Dec. 20, 2026, and the 3D Secure requirement and extra monitoring run until that date.